Unusual HTTP Download (Sysmon)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Detects possible malicious download which was made using a browser or wget over the http or https protocol.

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1071.001` Application Layer Protocol: Web Protocols `T1105` Ingress Tool Transfer

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 3: Network connection
Sysmon	Event ID 15: FileCreateStreamHash

Rule body

id: '1045.1073'
title: Unusual HTTP Download
description: Detects possible malicious download which was made using a browser or
  wget over the http or https protocol.
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_sysmon` ((EventCode=3 (protocol="https"
  OR protocol="http"))) OR (EventCode=15 AND ("chrome.exe"OR "firefox.exe" OR "iexplorer.exe"
  OR "opera.exe" OR "MicrosoftEdge.exe"))| table _time, host, user, host, dest_ip,
  src_ip, dvc, tag, process_*, event_id, dest_port, src_port, dvc_nt_host, signature,
  user, direction, protocol| bin span=60s | stats values(*) as * by _time, host |
  table _time, host, user, dest_ip, dest_port, src_ip, src_port, event_id, process_id,
  process_name, process_path, signature, direction, protocol `hec_collect`'
techniques:
- command-and-control:ingress tool transfer
- command-and-control:application layer protocol:web protocols
technique_id:
- T1105
- T1071.001
data_category:
- Windows Sysmon
references: null

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_sysmon` ((EventCode=3 (protocol="https" OR protocol="http"))) OR (EventCode=15 AND ("chrome.exe"OR "firefox.exe" OR "iexplorer.exe" OR "opera.exe" OR "MicrosoftEdge.exe"))

Stage 2: `table`

| table _time, host, user, host, dest_ip, src_ip, dvc, tag, process_*, event_id, dest_port, src_port, dvc_nt_host, signature, user, direction, protocol

Stage 3: `bucket`

| bin span=60s

Stage 4: `stats`

| stats values(*) as * by _time, host

Stage 5: `table`

| table _time, host, user, dest_ip, dest_port, src_ip, src_port, event_id, process_id, process_name, process_path, signature, direction, protocol `hec_collect`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`15` corpus 6 (splunk 6) `3` corpus 24 (splunk 14, kusto 8, chronicle 2)	`field:"EventID" kind:eq`
`protocol`	eq	`"http"` `"https"`	`field:"protocol" kind:eq`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"chrome.exe"`
1	`"firefox.exe"`
1	`"iexplorer.exe"`
1	`"opera.exe"`
1	`"MicrosoftEdge.exe"`